underhand trojan

[ikenn]

help! i think i got a virus. well not really me but i mean the mac that my officemate have been using. here's the situation... there are no open window in the finder yet when i press F9 an empty window appear and a title bar that say underhand 05 a. i'll attachan image so you guys can see what i mean. Is there a way to remove this?

[xineizer]

Whoa! Does it remain that way even after a restart?

Check out the discussion here.

[Edited on 1-18-2005 by xineizer]

[Henjie]

Originally posted by ikenn
help! i think i got a virus. well not really me but i mean the mac that my officemate have been using. here's the situation... there are no open window in the finder yet when i press F9 an empty window appear and a title bar that say underhand 05 a. i'll attachan image so you guys can see what i mean. Is there a way to remove this?

Underhand trojan. Must have gotten it through P2P.

Check if it's listed under System Preferences -> Accounts -> account name -> Startup Items. If it is, remove it from the list.


~Henjie

[ikenn]

it could have came from p2p. don't know how since i dont really use this emac. just found out that it is in start up item. Only it has the name of Apple Motion. And the trojan is been here for a month already and i was just told now! So far its working ok now don't see it since i shut it of in the Startup item. But is that the only solution or should i becareful of any hidden attacks? and what is this thing anyway?

[Henjie]

Originally posted by ikenn
But is that the only solution or should i becareful of any hidden attacks? and what is this thing anyway?

That's about it. You can try looking for the actual app so you can delete it from the system though. But as long as it's not running, then the system will be fine.

Underhand: A tunnel program allowing your computer's outgoing connections to run through an unsuspecting victim's computer, making you appear to any server as the victim. Very useful when you want to come in to a server without revealing your real IP (quote from this page).


~Henjie

[ikenn]

i dont understand what a tunnel program is. but as along as the computer is ok i'm fine with it. now i have to wait for my officemate tomorrow to find out what he has been doing to this Mac.

BTW thanks guys

[Edited on 1-18-2005 by ikenn]